Play Com. Security breach

Inactive

nilrem wrote: »

Does anyone know how to remove CC details from a Play account?

There does not seem to be an option to remove only update?

I asked them; Their reply, it is not possible, you have to close your account in order to remove your information.

They said that their servers are BT Secure, well that inspires confidence ... not !!!.

aerostar

More info here - also read the comments

http://forums.theregister.co.uk/forum/1/2011/03/22/play_malware_spam/

aliEnRIK

aerostar wrote: »

More info here - also read the comments

http://forums.theregister.co.uk/forum/1/2011/03/22/play_malware_spam/

Anyone spot a fault with the first comment?

debitcardmayhem

aliEnRIK wrote: »

Anyone spot a fault with the first comment?

Sky's the limit perhaps

aliEnRIK

debitcardmayhem wrote: »

Sky's the limit perhaps

It certainly seems that way

TheGerbil

My email account that I use for play.com is being sent mails faster than I can download them...
Since yesterday afternoon I've been in a right mess with my emails, randomly getting mails through hours after they wee sent, I looked into it I realised that this was happening just an hour ago, then just a moment ago I had the one from Play saying that they'd been hacked (well the marketing co.)........ NOT HAPPY if it continues then I'll have to let all my customers know that the email address is changing and change it on any login systems that use it. We're talking 1000's of emails out and god knows how many systems.

Even registering for this forum was difficult, I'm using a different account just so I could post. And the collection was really slow while the other 500 mails are downloaded.

The compromised account is downloading 200 at a time and by the time its done those there's another 300!!!!!!!!!!

What's the gaff on compensation from Play? They passed my email onto a third-party. Surely there's something in data protection to cover this?

nilrem_2

Update email received -:

Dear Customer,
As a follow up to the email we sent you last night, I would like to give you some further details. On Sunday the 20th of March some customers reported receiving a spam email to email addresses they only use for Play.com. We reacted immediately by informing all our customers of this potential security breach in order for them to take the necessary precautionary steps.
We believe this issue may be related to some irregular activity that was identified in December 2010 at our email service provider, Silverpop. Investigations at the time showed no evidence that any of our customer email addresses had been downloaded. We would like to assure all our customers that the only information communicated to our email service provider was email addresses. Play.com have taken all the necessary steps with Silverpop to ensure a security breach of this nature does not happen again.
We would also like to reassure our customers that all other personal information (i.e. credit cards, addresses, passwords, etc.) are kept in the very secure Play.com environment. Play.com has one of the most stringent internal standards of e-commerce security in the industry. This is audited and tested several times a year by leading internet security companies to ensure this high level of security is maintained. On behalf of Play.com, I would like to once again apologise to our customers for any inconvenience due to a potential increase in spam that may be caused by this issue .
Best regards,
John
John Perkins
CEO
Play.com

Inactive

nilrem wrote: »

Update email received -:

Ditto, hardly reassuring .. :mad:

wacko911

Closed my account. If enough people do, maybe they will pay more attention to securty in future.

Ximian

I wonder what John Perkins means with the following: "Play.com have taken all the necessary steps with Silverpop to ensure a security breach of this nature does not happen again."

That's a bold statement.
So he's saying that Play.com is staying with the SAME company that was compromised?
What steps were taken to ensure this never happens again? Additional security devices, regular audits, a patch applied that addresses the vulnerability?

You would have hoped that the "necessary steps" would have been taken to PREVENT a compromise in the first place!